0002-00000008

Problem description

The security token in the request is invalid.

Causes

The request uses Security Token Service (STS) temporary access credentials to access OSS, but the security token in the request is invalid.

Examples

• URL-based request: The OSSAccessKeyId in the request URL comes from STS, but the security-token query parameter does not match the security token issued by STS.

• Header-based request: The OSSAccessKeyId in the request headers comes from STS, but the x-oss-security-token header does not match the security token issued by STS.

Solutions

Use the complete set of temporary access credentials returned by STS — the security token and the temporary AccessKey pair must all come from the same STS response.

1. Call the AssumeRole operation or use STS SDKs to get temporary access credentials. STS returns a security token and a temporary AccessKey pair (AccessKey ID + AccessKey secret). For details, see Use temporary credentials provided by STS to access OSS.

2. Use an SDK or call the RESTful API operation to initiate a request using the access credentials obtained from STS. Example of a correctly signed URL:

      https://examplebucket.oss-cn-hangzhou.aliyuncs.com/oss-api.pdf?OSSAccessKeyId=STS.nz2pc56s936****&Expires=1141889120&Signature=vjbyPxybdZaNmGa%2ByT272YEAiv****&security-token=CAISowJ1q6Ft5B2yfSjIr5bgIOz31blR9oWmWBfCs3kDR/xm3Imc1zz2IHxMdHJsCeAcs/Q0lGFR5/sflqJIRoReREvCUcZr8szfWcsZos2T1fau5Jko1be0ewHKeQKZsebWZ+LmNpy/Ht6md1HDkAJq3LL+bk/Mdle5MJqP+/kFC9MMRVuAcCZhDtVbLRcYgq18D3bKMuu3ORPHm3fZCFES2jBxkmRi86+ysIP+phPVlw/90fRH5dazcJW0Zsx0OJo6Wcq+3+FqM6DQlTNM6hwNtoUO1fYUommb54nDXwQIvUjfbtC5qIM/cFVLAYEhALNBofTGkvl1h/fejYyfyWwWYbkFCHiPFNr9kJCUSbr4a4sjF6zyPnPWycyCLYXleLzhxPWd/2kagAGaXG69BqwYNvrKKI3W8weP3bNc1wQDMXQfiHpFCRG6lYhh3iXFtpwH90A3sTlxzRGvi8+9p63JwrluOHWs+Fj6S6s0cOhKvKRWYE8UuWeXIvv4l6DAGwHDE8BLjLC11f5prUJgI2wb+3hwuBod32Jx+us/1p996Glao725orcb****